@cabane/companion 0.6.105 → 0.6.107

package/dist/cli.js

@@ -93,7 +93,15 @@ var prepareHookSchema = z.object({
   //
   // Default OFF, and deliberately: an operator hook that provisions
   // unconditionally must not start running on every turn because it upgraded.
-  validateCached: z.boolean().optional()
+  validateCached: z.boolean().optional(),
+  // Independent operator-owned reporter. Receives sanitized failure metadata
+  // on stdin; never re-enters this hook and cannot change the turn outcome.
+  failureReporter: z.object({
+    command: z.string().min(1),
+    args: z.array(z.string()).optional(),
+    env: z.record(z.string(), z.string()).optional(),
+    timeoutMs: z.number().int().positive().max(3e4).optional()
+  }).strict().optional()
 }).strict();
 var DEFAULT_TIMEOUT_MS = 10 * 6e4;
 var prepareResultSchema = z.object({
@@ -1769,8 +1777,8 @@ function requestEnrollmentCode(baseUrl, opts = {}) {
     ...opts.label ? { label: opts.label } : {}
   });
 }
-function deviceLabelFromHostname(hostname4) {
-  const trimmed = hostname4.trim().replace(/\.local$/i, "");
+function deviceLabelFromHostname(hostname5) {
+  const trimmed = hostname5.trim().replace(/\.local$/i, "");
   if (trimmed.length === 0) return void 0;
   return trimmed.slice(0, 120);
 }
@@ -2097,7 +2105,7 @@ async function logs(opts = {}) {
 }
 
 // src/commands/start.ts
-import { hostname as hostname3 } from "os";
+import { hostname as hostname4 } from "os";
 
 // src/runtime.ts
 import { randomUUID as randomUUID5 } from "crypto";
@@ -2662,7 +2670,7 @@ async function warnAboutHarnessReadiness(cfg, deps = {}) {
 }
 
 // src/supervisor.ts
-import { hostname as hostname2 } from "os";
+import { hostname as hostname3 } from "os";
 
 // packages/agent-runtime/src/failure.ts
 import { z as z4 } from "zod";
@@ -7139,6 +7147,67 @@ function isStringRecord2(v) {
 import {
   Codex
 } from "@openai/codex-sdk";
+
+// packages/agent-runtime/src/codex/config-overrides.ts
+var TOML_BARE_KEY = /^[A-Za-z0-9_-]+$/;
+function formatKey(key) {
+  return TOML_BARE_KEY.test(key) ? key : JSON.stringify(key);
+}
+function isTable(value) {
+  return !!value && typeof value === "object" && !Array.isArray(value);
+}
+function tomlValue(value, path) {
+  if (typeof value === "string") return JSON.stringify(value);
+  if (typeof value === "number") {
+    if (!Number.isFinite(value)) {
+      throw new Error(`Codex config override at ${path} must be a finite number`);
+    }
+    return `${value}`;
+  }
+  if (typeof value === "boolean") return value ? "true" : "false";
+  if (Array.isArray(value)) {
+    return `[${value.map((item, i) => tomlValue(item, `${path}[${i}]`)).join(", ")}]`;
+  }
+  if (isTable(value)) {
+    const parts = [];
+    for (const [key, child] of Object.entries(value)) {
+      if (!key) throw new Error("Codex config override keys must be non-empty strings");
+      if (child === void 0) continue;
+      parts.push(`${formatKey(key)} = ${tomlValue(child, `${path}.${key}`)}`);
+    }
+    return `{${parts.join(", ")}}`;
+  }
+  throw new Error(`Codex config override at ${path} has an unsupported type`);
+}
+function walk(table, prefix, out) {
+  const entries = Object.entries(table).filter(([, child]) => child !== void 0);
+  if (entries.length === 0) {
+    if (prefix) out.push(`${prefix}={}`);
+    return;
+  }
+  for (const [key] of entries) {
+    if (!key) throw new Error("Codex config override keys must be non-empty strings");
+  }
+  if (entries.some(([key]) => !TOML_BARE_KEY.test(key))) {
+    if (!prefix) {
+      throw new Error("Codex config override has a non-bare key at the root");
+    }
+    out.push(`${prefix}=${tomlValue(Object.fromEntries(entries), prefix)}`);
+    return;
+  }
+  for (const [key, child] of entries) {
+    const path = prefix ? `${prefix}.${key}` : key;
+    if (isTable(child)) walk(child, path, out);
+    else out.push(`${path}=${tomlValue(child, path)}`);
+  }
+}
+function buildConfigOverrides(config) {
+  const out = [];
+  walk(config, "", out);
+  return out;
+}
+
+// packages/agent-runtime/src/codex/transport.ts
 function buildSdkThreadOptions(spec) {
   return {
     ...spec.model ? { model: spec.model } : {},
@@ -7155,11 +7224,17 @@ function createSdkCodexTransport(opts = {}) {
       const codexOptions = {
         ...opts.apiKey ? { apiKey: opts.apiKey } : {},
         ...opts.codexPathOverride ? { codexPathOverride: opts.codexPathOverride } : {},
-        // The `--config` overrides (MCP servers + rmcp flag). Cast at the SDK
-        // boundary — `CodexConfig` is a TOML-shaped plain object the SDK flattens
-        // to dotted `--config key=value` flags (verified against the SDK's
-        // `serializeConfigOverrides`).
-        config: spec.config
+        // The `--config` overrides (MCP servers + rmcp flag). CT1501: rendered to
+        // finished `--config` strings by US and passed through `configOverrides`,
+        // the SDK's raw passthrough — NOT through `config`, which would flatten
+        // them itself. A user MCP server named `my.server` cannot go in an
+        // override's dotted path at all (the CLI splits the path on `.` and
+        // ignores TOML quoting), so it has to ride inside an inline-table value,
+        // and the SDK's flattener cannot be steered into producing one. This is
+        // also what makes the PUBLISHED companion correct, where the vendored
+        // patch never reached — and why that patch is gone. See
+        // `config-overrides.ts`.
+        configOverrides: buildConfigOverrides(spec.config)
       };
       const codex = new Codex(codexOptions);
       const threadOptions = buildSdkThreadOptions(spec);
@@ -8537,6 +8612,68 @@ function readOutboxFloor(read, turnId, log) {
   }
 }
 
+// src/prepare-failure.ts
+import { spawn as spawn4 } from "child_process";
+import { hostname as hostname2 } from "os";
+function prepareFailureCause(error) {
+  const message = error instanceof Error ? error.message : String(error);
+  if (/timed out/i.test(message)) return "prepare hook timed out";
+  if (/MODULE_NOT_FOUND|Cannot find (?:module|package)/.test(message))
+    return "prepare hook module missing; check the configured command and its installation for this device";
+  if (/not valid JSON|JSON must carry|produced no output/.test(message))
+    return "prepare hook returned malformed output; expected a cwd path or JSON with a non-empty cwd";
+  if (/ENOENT/.test(message)) return "prepare hook executable missing (ENOENT)";
+  if (/EACCES/.test(message)) return "prepare hook executable is not accessible (EACCES)";
+  const exit = message.match(/exited with code (\d+)/)?.[1];
+  return exit ? `prepare hook exited with code ${exit}` : "prepare hook failed; inspect the device-local hook log";
+}
+async function runPrepareWithReporting(runner, hook, input, context, reportError) {
+  try {
+    return await runner(hook, input);
+  } catch (error) {
+    if (hook.failureReporter) {
+      try {
+        await reportFailure(hook.failureReporter, {
+          workspaceId: input.workspaceId,
+          conversationId: input.conversationId,
+          agentId: input.agentId,
+          agentUsername: input.agentUsername,
+          turnId: context.turnId,
+          deviceId: context.deviceId ?? hostname2(),
+          cause: prepareFailureCause(error)
+        });
+      } catch {
+        reportError();
+      }
+    }
+    throw error;
+  }
+}
+function reportFailure(config, body) {
+  return new Promise((resolve2, reject) => {
+    const child = spawn4(config.command, config.args ?? [], {
+      stdio: ["pipe", "ignore", "ignore"],
+      env: { ...process.env, ...config.env }
+    });
+    const timer = setTimeout(() => {
+      child.kill("SIGKILL");
+      reject(new Error("reporter timeout"));
+    }, config.timeoutMs ?? 15e3);
+    child.stdin.on("error", () => {
+    });
+    child.once("error", () => {
+      clearTimeout(timer);
+      reject(new Error("reporter failed to start"));
+    });
+    child.once("close", (code) => {
+      clearTimeout(timer);
+      if (code === 0) resolve2();
+      else reject(new Error("reporter failed"));
+    });
+    child.stdin.end(JSON.stringify(body));
+  });
+}
+
 // src/prepared.ts
 import { mkdirSync as mkdirSync8, readFileSync as readFileSync6, rmSync as rmSync5, writeFileSync as writeFileSync6, existsSync as existsSync8 } from "fs";
 import { join as join12 } from "path";
@@ -8767,7 +8904,7 @@ function pruneOld(dir2, retain) {
 }
 
 // src/turn-containment.ts
-import { execFile, execFileSync, spawn as spawn4 } from "child_process";
+import { execFile, execFileSync, spawn as spawn5 } from "child_process";
 import { readFileSync as readFileSync8 } from "fs";
 import { promisify } from "util";
 var execFileAsync = promisify(execFile);
@@ -8849,7 +8986,7 @@ function createTurnContainment(turnId, deps = {}) {
       command: options.command
     });
     return asContained(
-      spawn4(
+      spawn5(
         "systemd-run",
         [
           "--user",
@@ -8876,7 +9013,7 @@ function createTurnContainment(turnId, deps = {}) {
     );
   }
   function spawnInGroup(options) {
-    const child = spawn4(options.command, options.args, {
+    const child = spawn5(options.command, options.args, {
       ...options.cwd ? { cwd: options.cwd } : {},
       env: options.env,
       stdio: ["pipe", "pipe", "pipe"],
@@ -9578,18 +9715,28 @@ var TurnExecution = class {
         if (prepareHook.validateCached) {
           const runHook = this.opts.prepareHookRunner ?? runPrepareHook;
           try {
-            await runHook(prepareHook, {
-              workspaceId,
-              conversationId: payload.conversationId,
-              agentId: payload.agentId,
-              agentUsername: this.opts.agentUsername,
-              runtime: this.turnContext.runtime,
-              hostAccess: this.turnContext.policy.hostFs,
-              triggerEntryPaths: this.turnContext.conversation.triggerEntryPaths ?? [],
-              title: this.turnContext.conversation.title,
-              messageBody: this.turnContext.message.body,
-              prepared: cached2
-            });
+            await runPrepareWithReporting(
+              runHook,
+              prepareHook,
+              {
+                workspaceId,
+                conversationId: payload.conversationId,
+                agentId: payload.agentId,
+                agentUsername: this.opts.agentUsername,
+                runtime: this.turnContext.runtime,
+                hostAccess: this.turnContext.policy.hostFs,
+                triggerEntryPaths: this.turnContext.conversation.triggerEntryPaths ?? [],
+                title: this.turnContext.conversation.title,
+                messageBody: this.turnContext.message.body,
+                prepared: cached2
+              },
+              { turnId, deviceId: this.opts.deviceId },
+              () => {
+                turnLog.error(
+                  "dispatcher: prepare failure reporter failed; original failure preserved"
+                );
+              }
+            );
           } catch (err) {
             const reason = err instanceof Error ? err.message : String(err);
             turnLog.debug({ err: reason }, "dispatcher: prepare hook rejected a prepared turn");
@@ -9625,24 +9772,34 @@ var TurnExecution = class {
         preparingTimer.unref?.();
         const runHook = this.opts.prepareHookRunner ?? runPrepareHook;
         try {
-          const result = await runHook(prepareHook, {
-            workspaceId,
-            conversationId: payload.conversationId,
-            agentId: payload.agentId,
-            agentUsername: this.opts.agentUsername,
-            runtime: this.turnContext.runtime,
-            hostAccess: this.turnContext.policy.hostFs,
-            // CT317/CT319: the trigger message's referenced-entry paths — what the
-            // tasker prepare hook keys its per-task env off. Defaults to `[]` for
-            // an older API. The conversation anchor is gone (CT319).
-            triggerEntryPaths: this.turnContext.conversation.triggerEntryPaths ?? [],
-            title: this.turnContext.conversation.title,
-            // CT943: the dispatching message's text — where an `env:` directive
-            // rides. The server has always sent the trigger body on the turn
-            // context (for the live feed); this is the first thing to read it as
-            // an INPUT, so a dispatch can ask for its environment in words.
-            messageBody: this.turnContext.message.body
-          });
+          const result = await runPrepareWithReporting(
+            runHook,
+            prepareHook,
+            {
+              workspaceId,
+              conversationId: payload.conversationId,
+              agentId: payload.agentId,
+              agentUsername: this.opts.agentUsername,
+              runtime: this.turnContext.runtime,
+              hostAccess: this.turnContext.policy.hostFs,
+              // CT317/CT319: the trigger message's referenced-entry paths — what the
+              // tasker prepare hook keys its per-task env off. Defaults to `[]` for
+              // an older API. The conversation anchor is gone (CT319).
+              triggerEntryPaths: this.turnContext.conversation.triggerEntryPaths ?? [],
+              title: this.turnContext.conversation.title,
+              // CT943: the dispatching message's text — where an `env:` directive
+              // rides. The server has always sent the trigger body on the turn
+              // context (for the live feed); this is the first thing to read it as
+              // an INPUT, so a dispatch can ask for its environment in words.
+              messageBody: this.turnContext.message.body
+            },
+            { turnId, deviceId: this.opts.deviceId },
+            () => {
+              turnLog.error(
+                "dispatcher: prepare failure reporter failed; original failure preserved"
+              );
+            }
+          );
           clearTimeout(preparingTimer);
           if (preparingStarted) reportPreparing("done");
           writePrepared(workspaceId, payload.conversationId, payload.agentId, result);
@@ -10803,7 +10960,7 @@ var CompanionSupervisor = class {
   async start() {
     this.log.info(
       { protocolVersion: TURN_PROTOCOL_VERSION, version: COMPANION_VERSION },
-      `Companion ${COMPANION_VERSION} starting on ${this.config.deviceLabel ?? hostname2()}`
+      `Companion ${COMPANION_VERSION} starting on ${this.config.deviceLabel ?? hostname3()}`
     );
     const startupHarnessRefresh = this.refreshHarnessStatuses();
     this.trackHeartbeat(startupHarnessRefresh);
@@ -10822,7 +10979,7 @@ var CompanionSupervisor = class {
       token: this.config.deviceToken,
       log: this.log,
       lastEventId: null,
-      onOpen: () => this.log.info(`Connected to Cabane as ${this.hub.statusJson().device_label ?? hostname2()}`),
+      onOpen: () => this.log.info(`Connected to Cabane as ${this.hub.statusJson().device_label ?? hostname3()}`),
       onMessage: async (ev) => {
         if (ev.event === "assignments_changed") {
           if (this.refreshing && this.inFlightRefresh) await this.inFlightRefresh;
@@ -11238,6 +11395,7 @@ var CompanionSupervisor = class {
     });
     if (this.dispatcherFactory) return this.dispatcherFactory({ ...ctx, local });
     return new Dispatcher({
+      deviceId: this.deviceId ?? void 0,
       api: ctx.api,
       baseUrl: ctx.baseUrl,
       workspaceId: ctx.workspaceId,
@@ -11885,9 +12043,9 @@ async function waitForBoundedHeartbeat(heartbeat) {
 }
 function defaultReexec() {
   clearRuntimeState();
-  void import("child_process").then(({ spawn: spawn6 }) => {
+  void import("child_process").then(({ spawn: spawn7 }) => {
     try {
-      const child = spawn6(process.execPath, process.argv.slice(1), {
+      const child = spawn7(process.execPath, process.argv.slice(1), {
         stdio: "inherit",
         detached: false
       });
@@ -12142,7 +12300,7 @@ async function closeSurfaces(control, dashboard) {
 }
 
 // src/commands/daemon.ts
-import { spawn as spawn5 } from "child_process";
+import { spawn as spawn6 } from "child_process";
 import { closeSync as closeSync3, mkdirSync as mkdirSync12, openSync as openSync3 } from "fs";
 
 // src/cli-entry.ts
@@ -12254,7 +12412,7 @@ function defaultSpawnDetached(args) {
   mkdirSync12(cabaneDir(), { recursive: true });
   const logFd = openSync3(companionLogPath(), "a");
   try {
-    return spawn5(process.execPath, [cliPath, ...args], {
+    return spawn6(process.execPath, [cliPath, ...args], {
       detached: true,
       stdio: ["ignore", logFd, logFd],
       env: { ...process.env, CABANE_COMPANION_DAEMON: "1" }
@@ -12422,7 +12580,7 @@ function prePairFoundPhrase(harness) {
 }
 async function pairHere(opts, interactive) {
   const baseUrl = resolvePairBaseUrl(opts.server);
-  const label = deviceLabelFromHostname(hostname3());
+  const label = deviceLabelFromHostname(hostname4());
   const aborter = new AbortController();
   const onSigint = () => aborter.abort();
   process.on("SIGINT", onSigint);

package/dist/pairing-config.js

@@ -76,7 +76,15 @@ var prepareHookSchema = z.object({
   //
   // Default OFF, and deliberately: an operator hook that provisions
   // unconditionally must not start running on every turn because it upgraded.
-  validateCached: z.boolean().optional()
+  validateCached: z.boolean().optional(),
+  // Independent operator-owned reporter. Receives sanitized failure metadata
+  // on stdin; never re-enters this hook and cannot change the turn outcome.
+  failureReporter: z.object({
+    command: z.string().min(1),
+    args: z.array(z.string()).optional(),
+    env: z.record(z.string(), z.string()).optional(),
+    timeoutMs: z.number().int().positive().max(3e4).optional()
+  }).strict().optional()
 }).strict();
 var DEFAULT_TIMEOUT_MS = 10 * 6e4;
 var prepareResultSchema = z.object({

package/dist/runtime.js

@@ -85,7 +85,15 @@ var prepareHookSchema = z.object({
   //
   // Default OFF, and deliberately: an operator hook that provisions
   // unconditionally must not start running on every turn because it upgraded.
-  validateCached: z.boolean().optional()
+  validateCached: z.boolean().optional(),
+  // Independent operator-owned reporter. Receives sanitized failure metadata
+  // on stdin; never re-enters this hook and cannot change the turn outcome.
+  failureReporter: z.object({
+    command: z.string().min(1),
+    args: z.array(z.string()).optional(),
+    env: z.record(z.string(), z.string()).optional(),
+    timeoutMs: z.number().int().positive().max(3e4).optional()
+  }).strict().optional()
 }).strict();
 var DEFAULT_TIMEOUT_MS = 10 * 6e4;
 var prepareResultSchema = z.object({
@@ -1996,7 +2004,7 @@ async function verifyRuntime(state, requestImpl = controlRequest) {
 }
 
 // src/supervisor.ts
-import { hostname } from "os";
+import { hostname as hostname2 } from "os";
 
 // packages/agent-runtime/src/failure.ts
 import { z as z3 } from "zod";
@@ -6552,6 +6560,67 @@ function isStringRecord2(v) {
 import {
   Codex
 } from "@openai/codex-sdk";
+
+// packages/agent-runtime/src/codex/config-overrides.ts
+var TOML_BARE_KEY = /^[A-Za-z0-9_-]+$/;
+function formatKey(key) {
+  return TOML_BARE_KEY.test(key) ? key : JSON.stringify(key);
+}
+function isTable(value) {
+  return !!value && typeof value === "object" && !Array.isArray(value);
+}
+function tomlValue(value, path) {
+  if (typeof value === "string") return JSON.stringify(value);
+  if (typeof value === "number") {
+    if (!Number.isFinite(value)) {
+      throw new Error(`Codex config override at ${path} must be a finite number`);
+    }
+    return `${value}`;
+  }
+  if (typeof value === "boolean") return value ? "true" : "false";
+  if (Array.isArray(value)) {
+    return `[${value.map((item, i) => tomlValue(item, `${path}[${i}]`)).join(", ")}]`;
+  }
+  if (isTable(value)) {
+    const parts = [];
+    for (const [key, child] of Object.entries(value)) {
+      if (!key) throw new Error("Codex config override keys must be non-empty strings");
+      if (child === void 0) continue;
+      parts.push(`${formatKey(key)} = ${tomlValue(child, `${path}.${key}`)}`);
+    }
+    return `{${parts.join(", ")}}`;
+  }
+  throw new Error(`Codex config override at ${path} has an unsupported type`);
+}
+function walk(table, prefix, out) {
+  const entries = Object.entries(table).filter(([, child]) => child !== void 0);
+  if (entries.length === 0) {
+    if (prefix) out.push(`${prefix}={}`);
+    return;
+  }
+  for (const [key] of entries) {
+    if (!key) throw new Error("Codex config override keys must be non-empty strings");
+  }
+  if (entries.some(([key]) => !TOML_BARE_KEY.test(key))) {
+    if (!prefix) {
+      throw new Error("Codex config override has a non-bare key at the root");
+    }
+    out.push(`${prefix}=${tomlValue(Object.fromEntries(entries), prefix)}`);
+    return;
+  }
+  for (const [key, child] of entries) {
+    const path = prefix ? `${prefix}.${key}` : key;
+    if (isTable(child)) walk(child, path, out);
+    else out.push(`${path}=${tomlValue(child, path)}`);
+  }
+}
+function buildConfigOverrides(config) {
+  const out = [];
+  walk(config, "", out);
+  return out;
+}
+
+// packages/agent-runtime/src/codex/transport.ts
 function buildSdkThreadOptions(spec) {
   return {
     ...spec.model ? { model: spec.model } : {},
@@ -6568,11 +6637,17 @@ function createSdkCodexTransport(opts = {}) {
       const codexOptions = {
         ...opts.apiKey ? { apiKey: opts.apiKey } : {},
         ...opts.codexPathOverride ? { codexPathOverride: opts.codexPathOverride } : {},
-        // The `--config` overrides (MCP servers + rmcp flag). Cast at the SDK
-        // boundary — `CodexConfig` is a TOML-shaped plain object the SDK flattens
-        // to dotted `--config key=value` flags (verified against the SDK's
-        // `serializeConfigOverrides`).
-        config: spec.config
+        // The `--config` overrides (MCP servers + rmcp flag). CT1501: rendered to
+        // finished `--config` strings by US and passed through `configOverrides`,
+        // the SDK's raw passthrough — NOT through `config`, which would flatten
+        // them itself. A user MCP server named `my.server` cannot go in an
+        // override's dotted path at all (the CLI splits the path on `.` and
+        // ignores TOML quoting), so it has to ride inside an inline-table value,
+        // and the SDK's flattener cannot be steered into producing one. This is
+        // also what makes the PUBLISHED companion correct, where the vendored
+        // patch never reached — and why that patch is gone. See
+        // `config-overrides.ts`.
+        configOverrides: buildConfigOverrides(spec.config)
       };
       const codex = new Codex(codexOptions);
       const threadOptions = buildSdkThreadOptions(spec);
@@ -7960,6 +8035,68 @@ function readOutboxFloor(read, turnId, log) {
   }
 }
 
+// src/prepare-failure.ts
+import { spawn as spawn4 } from "child_process";
+import { hostname } from "os";
+function prepareFailureCause(error) {
+  const message = error instanceof Error ? error.message : String(error);
+  if (/timed out/i.test(message)) return "prepare hook timed out";
+  if (/MODULE_NOT_FOUND|Cannot find (?:module|package)/.test(message))
+    return "prepare hook module missing; check the configured command and its installation for this device";
+  if (/not valid JSON|JSON must carry|produced no output/.test(message))
+    return "prepare hook returned malformed output; expected a cwd path or JSON with a non-empty cwd";
+  if (/ENOENT/.test(message)) return "prepare hook executable missing (ENOENT)";
+  if (/EACCES/.test(message)) return "prepare hook executable is not accessible (EACCES)";
+  const exit = message.match(/exited with code (\d+)/)?.[1];
+  return exit ? `prepare hook exited with code ${exit}` : "prepare hook failed; inspect the device-local hook log";
+}
+async function runPrepareWithReporting(runner, hook, input, context, reportError) {
+  try {
+    return await runner(hook, input);
+  } catch (error) {
+    if (hook.failureReporter) {
+      try {
+        await reportFailure(hook.failureReporter, {
+          workspaceId: input.workspaceId,
+          conversationId: input.conversationId,
+          agentId: input.agentId,
+          agentUsername: input.agentUsername,
+          turnId: context.turnId,
+          deviceId: context.deviceId ?? hostname(),
+          cause: prepareFailureCause(error)
+        });
+      } catch {
+        reportError();
+      }
+    }
+    throw error;
+  }
+}
+function reportFailure(config, body) {
+  return new Promise((resolve2, reject) => {
+    const child = spawn4(config.command, config.args ?? [], {
+      stdio: ["pipe", "ignore", "ignore"],
+      env: { ...process.env, ...config.env }
+    });
+    const timer = setTimeout(() => {
+      child.kill("SIGKILL");
+      reject(new Error("reporter timeout"));
+    }, config.timeoutMs ?? 15e3);
+    child.stdin.on("error", () => {
+    });
+    child.once("error", () => {
+      clearTimeout(timer);
+      reject(new Error("reporter failed to start"));
+    });
+    child.once("close", (code) => {
+      clearTimeout(timer);
+      if (code === 0) resolve2();
+      else reject(new Error("reporter failed"));
+    });
+    child.stdin.end(JSON.stringify(body));
+  });
+}
+
 // src/prepared.ts
 import { mkdirSync as mkdirSync8, readFileSync as readFileSync6, rmSync as rmSync5, writeFileSync as writeFileSync6, existsSync as existsSync8 } from "fs";
 import { join as join12 } from "path";
@@ -8190,7 +8327,7 @@ function pruneOld(dir2, retain) {
 }
 
 // src/turn-containment.ts
-import { execFile, execFileSync, spawn as spawn4 } from "child_process";
+import { execFile, execFileSync, spawn as spawn5 } from "child_process";
 import { readFileSync as readFileSync8 } from "fs";
 import { promisify } from "util";
 var execFileAsync = promisify(execFile);
@@ -8272,7 +8409,7 @@ function createTurnContainment(turnId, deps = {}) {
       command: options.command
     });
     return asContained(
-      spawn4(
+      spawn5(
         "systemd-run",
         [
           "--user",
@@ -8299,7 +8436,7 @@ function createTurnContainment(turnId, deps = {}) {
     );
   }
   function spawnInGroup(options) {
-    const child = spawn4(options.command, options.args, {
+    const child = spawn5(options.command, options.args, {
       ...options.cwd ? { cwd: options.cwd } : {},
       env: options.env,
       stdio: ["pipe", "pipe", "pipe"],
@@ -9001,18 +9138,28 @@ var TurnExecution = class {
         if (prepareHook.validateCached) {
           const runHook = this.opts.prepareHookRunner ?? runPrepareHook;
           try {
-            await runHook(prepareHook, {
-              workspaceId,
-              conversationId: payload.conversationId,
-              agentId: payload.agentId,
-              agentUsername: this.opts.agentUsername,
-              runtime: this.turnContext.runtime,
-              hostAccess: this.turnContext.policy.hostFs,
-              triggerEntryPaths: this.turnContext.conversation.triggerEntryPaths ?? [],
-              title: this.turnContext.conversation.title,
-              messageBody: this.turnContext.message.body,
-              prepared: cached2
-            });
+            await runPrepareWithReporting(
+              runHook,
+              prepareHook,
+              {
+                workspaceId,
+                conversationId: payload.conversationId,
+                agentId: payload.agentId,
+                agentUsername: this.opts.agentUsername,
+                runtime: this.turnContext.runtime,
+                hostAccess: this.turnContext.policy.hostFs,
+                triggerEntryPaths: this.turnContext.conversation.triggerEntryPaths ?? [],
+                title: this.turnContext.conversation.title,
+                messageBody: this.turnContext.message.body,
+                prepared: cached2
+              },
+              { turnId, deviceId: this.opts.deviceId },
+              () => {
+                turnLog.error(
+                  "dispatcher: prepare failure reporter failed; original failure preserved"
+                );
+              }
+            );
           } catch (err) {
             const reason = err instanceof Error ? err.message : String(err);
             turnLog.debug({ err: reason }, "dispatcher: prepare hook rejected a prepared turn");
@@ -9048,24 +9195,34 @@ var TurnExecution = class {
         preparingTimer.unref?.();
         const runHook = this.opts.prepareHookRunner ?? runPrepareHook;
         try {
-          const result = await runHook(prepareHook, {
-            workspaceId,
-            conversationId: payload.conversationId,
-            agentId: payload.agentId,
-            agentUsername: this.opts.agentUsername,
-            runtime: this.turnContext.runtime,
-            hostAccess: this.turnContext.policy.hostFs,
-            // CT317/CT319: the trigger message's referenced-entry paths — what the
-            // tasker prepare hook keys its per-task env off. Defaults to `[]` for
-            // an older API. The conversation anchor is gone (CT319).
-            triggerEntryPaths: this.turnContext.conversation.triggerEntryPaths ?? [],
-            title: this.turnContext.conversation.title,
-            // CT943: the dispatching message's text — where an `env:` directive
-            // rides. The server has always sent the trigger body on the turn
-            // context (for the live feed); this is the first thing to read it as
-            // an INPUT, so a dispatch can ask for its environment in words.
-            messageBody: this.turnContext.message.body
-          });
+          const result = await runPrepareWithReporting(
+            runHook,
+            prepareHook,
+            {
+              workspaceId,
+              conversationId: payload.conversationId,
+              agentId: payload.agentId,
+              agentUsername: this.opts.agentUsername,
+              runtime: this.turnContext.runtime,
+              hostAccess: this.turnContext.policy.hostFs,
+              // CT317/CT319: the trigger message's referenced-entry paths — what the
+              // tasker prepare hook keys its per-task env off. Defaults to `[]` for
+              // an older API. The conversation anchor is gone (CT319).
+              triggerEntryPaths: this.turnContext.conversation.triggerEntryPaths ?? [],
+              title: this.turnContext.conversation.title,
+              // CT943: the dispatching message's text — where an `env:` directive
+              // rides. The server has always sent the trigger body on the turn
+              // context (for the live feed); this is the first thing to read it as
+              // an INPUT, so a dispatch can ask for its environment in words.
+              messageBody: this.turnContext.message.body
+            },
+            { turnId, deviceId: this.opts.deviceId },
+            () => {
+              turnLog.error(
+                "dispatcher: prepare failure reporter failed; original failure preserved"
+              );
+            }
+          );
           clearTimeout(preparingTimer);
           if (preparingStarted) reportPreparing("done");
           writePrepared(workspaceId, payload.conversationId, payload.agentId, result);
@@ -10226,7 +10383,7 @@ var CompanionSupervisor = class {
   async start() {
     this.log.info(
       { protocolVersion: TURN_PROTOCOL_VERSION, version: COMPANION_VERSION },
-      `Companion ${COMPANION_VERSION} starting on ${this.config.deviceLabel ?? hostname()}`
+      `Companion ${COMPANION_VERSION} starting on ${this.config.deviceLabel ?? hostname2()}`
     );
     const startupHarnessRefresh = this.refreshHarnessStatuses();
     this.trackHeartbeat(startupHarnessRefresh);
@@ -10245,7 +10402,7 @@ var CompanionSupervisor = class {
       token: this.config.deviceToken,
       log: this.log,
       lastEventId: null,
-      onOpen: () => this.log.info(`Connected to Cabane as ${this.hub.statusJson().device_label ?? hostname()}`),
+      onOpen: () => this.log.info(`Connected to Cabane as ${this.hub.statusJson().device_label ?? hostname2()}`),
       onMessage: async (ev) => {
         if (ev.event === "assignments_changed") {
           if (this.refreshing && this.inFlightRefresh) await this.inFlightRefresh;
@@ -10661,6 +10818,7 @@ var CompanionSupervisor = class {
     });
     if (this.dispatcherFactory) return this.dispatcherFactory({ ...ctx, local });
     return new Dispatcher({
+      deviceId: this.deviceId ?? void 0,
       api: ctx.api,
       baseUrl: ctx.baseUrl,
       workspaceId: ctx.workspaceId,
@@ -11308,9 +11466,9 @@ async function waitForBoundedHeartbeat(heartbeat) {
 }
 function defaultReexec() {
   clearRuntimeState();
-  void import("child_process").then(({ spawn: spawn5 }) => {
+  void import("child_process").then(({ spawn: spawn6 }) => {
     try {
-      const child = spawn5(process.execPath, process.argv.slice(1), {
+      const child = spawn6(process.execPath, process.argv.slice(1), {
         stdio: "inherit",
         detached: false
       });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cabane/companion",
-  "version": "0.6.105",
+  "version": "0.6.107",
   "type": "module",
   "description": "The Cabane Companion (headless): connect a coding agent on your machine to your Cabane workspace as a responder — drive work against your own codebase, files, and MCP servers without putting any of it in Cabane.",
   "license": "UNLICENSED",
@@ -29,8 +29,8 @@
     "prepublishOnly": "pnpm build"
   },
   "dependencies": {
-    "@anthropic-ai/claude-agent-sdk": "0.3.263",
-    "@openai/codex-sdk": "0.153.4",
+    "@anthropic-ai/claude-agent-sdk": "0.3.270",
+    "@openai/codex-sdk": "0.154.0",
     "@hono/node-server": "1.19.14",
     "@inquirer/prompts": "7.10.1",
     "commander": "12.1.0",